ppdev: Add an error check in register_device

In register_device, the return value of ida_simple_get is unchecked,
in witch ida_simple_get will use an invalid index value.

To address this issue, index should be checked after ida_simple_get. When
the index value is abnormal, a warning message should be printed, the port
should be dropped, and the value should be recorded.

Fixes: 9a69645dde11 ("ppdev: fix registering same device name")
Signed-off-by: Huai-Yuan Liu <qq810974084@gmail.com>
Link: https://lore.kernel.org/r/20240412083840.234085-1-qq810974084@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index ee951b265213fbb3bf5519ad4b1b02efd0e0fb5b..58e9dcc2a308749fec06f267a2bf251d68ca909c 100644 (file)
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -296,28 +296,35 @@ static int register_device(int minor, struct pp_struct *pp)
        if (!port) {
                pr_warn("%s: no associated port!\n", name);
                rc = -ENXIO;
-               goto err;
+               goto err_free_name;
        }
 
        index = ida_alloc(&ida_index, GFP_KERNEL);
+       if (index < 0) {
+               pr_warn("%s: failed to get index!\n", name);
+               rc = index;
+               goto err_put_port;
+       }
+
        memset(&ppdev_cb, 0, sizeof(ppdev_cb));
        ppdev_cb.irq_func = pp_irq;
        ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
        ppdev_cb.private = pp;
        pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
-       parport_put_port(port);
 
        if (!pdev) {
                pr_warn("%s: failed to register device!\n", name);
                rc = -ENXIO;
                ida_free(&ida_index, index);
-               goto err;
+               goto err_put_port;
        }
 
        pp->pdev = pdev;
        pp->index = index;
        dev_dbg(&pdev->dev, "registered pardevice\n");
-err:
+err_put_port:
+       parport_put_port(port);
+err_free_name:
        kfree(name);
        return rc;
 }